Date
July 8, 2025, 4:38 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 17.816702] ================================================================== [ 17.816749] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 17.816793] Read of size 1 at addr fff00000c4480e00 by task kunit_try_catch/166 [ 17.816841] [ 17.816869] CPU: 1 UID: 0 PID: 166 Comm: kunit_try_catch Tainted: G B N 6.15.6-rc1 #1 PREEMPT [ 17.816946] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.816972] Hardware name: linux,dummy-virt (DT) [ 17.817002] Call trace: [ 17.817024] show_stack+0x20/0x38 (C) [ 17.817070] dump_stack_lvl+0x8c/0xd0 [ 17.817116] print_report+0x118/0x608 [ 17.817160] kasan_report+0xdc/0x128 [ 17.817205] __asan_report_load1_noabort+0x20/0x30 [ 17.817281] krealloc_uaf+0x4c8/0x520 [ 17.817516] kunit_try_run_case+0x170/0x3f0 [ 17.817726] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.817974] kthread+0x328/0x630 [ 17.818143] ret_from_fork+0x10/0x20 [ 17.818241] [ 17.818331] Allocated by task 166: [ 17.818369] kasan_save_stack+0x3c/0x68 [ 17.818407] kasan_save_track+0x20/0x40 [ 17.818635] kasan_save_alloc_info+0x40/0x58 [ 17.818701] __kasan_kmalloc+0xd4/0xd8 [ 17.818736] __kmalloc_cache_noprof+0x16c/0x3c0 [ 17.818772] krealloc_uaf+0xc8/0x520 [ 17.818804] kunit_try_run_case+0x170/0x3f0 [ 17.818847] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.818889] kthread+0x328/0x630 [ 17.818924] ret_from_fork+0x10/0x20 [ 17.819435] [ 17.819470] Freed by task 166: [ 17.819693] kasan_save_stack+0x3c/0x68 [ 17.819735] kasan_save_track+0x20/0x40 [ 17.819778] kasan_save_free_info+0x4c/0x78 [ 17.819994] __kasan_slab_free+0x6c/0x98 [ 17.820240] kfree+0x214/0x3c8 [ 17.820410] krealloc_uaf+0x12c/0x520 [ 17.820475] kunit_try_run_case+0x170/0x3f0 [ 17.820620] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.820685] kthread+0x328/0x630 [ 17.820737] ret_from_fork+0x10/0x20 [ 17.820771] [ 17.820790] The buggy address belongs to the object at fff00000c4480e00 [ 17.820790] which belongs to the cache kmalloc-256 of size 256 [ 17.820861] The buggy address is located 0 bytes inside of [ 17.820861] freed 256-byte region [fff00000c4480e00, fff00000c4480f00) [ 17.820986] [ 17.821050] The buggy address belongs to the physical page: [ 17.821152] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104480 [ 17.821222] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 17.821267] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 17.821353] page_type: f5(slab) [ 17.821458] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 17.821522] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.821569] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 17.821616] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.821663] head: 0bfffe0000000001 ffffc1ffc3112001 00000000ffffffff 00000000ffffffff [ 17.821709] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 17.821747] page dumped because: kasan: bad access detected [ 17.821776] [ 17.821794] Memory state around the buggy address: [ 17.821823] fff00000c4480d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.821919] fff00000c4480d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.821982] >fff00000c4480e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.822111] ^ [ 17.822159] fff00000c4480e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.822227] fff00000c4480f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.822309] ================================================================== [ 17.809781] ================================================================== [ 17.809842] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 17.809892] Read of size 1 at addr fff00000c4480e00 by task kunit_try_catch/166 [ 17.809939] [ 17.809969] CPU: 1 UID: 0 PID: 166 Comm: kunit_try_catch Tainted: G B N 6.15.6-rc1 #1 PREEMPT [ 17.810049] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.810251] Hardware name: linux,dummy-virt (DT) [ 17.810475] Call trace: [ 17.810506] show_stack+0x20/0x38 (C) [ 17.810821] dump_stack_lvl+0x8c/0xd0 [ 17.810881] print_report+0x118/0x608 [ 17.810924] kasan_report+0xdc/0x128 [ 17.810967] __kasan_check_byte+0x54/0x70 [ 17.811010] krealloc_noprof+0x44/0x360 [ 17.811065] krealloc_uaf+0x180/0x520 [ 17.811226] kunit_try_run_case+0x170/0x3f0 [ 17.811274] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.811382] kthread+0x328/0x630 [ 17.811595] ret_from_fork+0x10/0x20 [ 17.811903] [ 17.811923] Allocated by task 166: [ 17.811972] kasan_save_stack+0x3c/0x68 [ 17.812088] kasan_save_track+0x20/0x40 [ 17.812125] kasan_save_alloc_info+0x40/0x58 [ 17.812162] __kasan_kmalloc+0xd4/0xd8 [ 17.812197] __kmalloc_cache_noprof+0x16c/0x3c0 [ 17.812270] krealloc_uaf+0xc8/0x520 [ 17.812517] kunit_try_run_case+0x170/0x3f0 [ 17.812606] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.812650] kthread+0x328/0x630 [ 17.812685] ret_from_fork+0x10/0x20 [ 17.812721] [ 17.812740] Freed by task 166: [ 17.812766] kasan_save_stack+0x3c/0x68 [ 17.812856] kasan_save_track+0x20/0x40 [ 17.812892] kasan_save_free_info+0x4c/0x78 [ 17.812930] __kasan_slab_free+0x6c/0x98 [ 17.812966] kfree+0x214/0x3c8 [ 17.812997] krealloc_uaf+0x12c/0x520 [ 17.813348] kunit_try_run_case+0x170/0x3f0 [ 17.813438] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.813488] kthread+0x328/0x630 [ 17.813524] ret_from_fork+0x10/0x20 [ 17.813560] [ 17.813579] The buggy address belongs to the object at fff00000c4480e00 [ 17.813579] which belongs to the cache kmalloc-256 of size 256 [ 17.813672] The buggy address is located 0 bytes inside of [ 17.813672] freed 256-byte region [fff00000c4480e00, fff00000c4480f00) [ 17.813733] [ 17.813752] The buggy address belongs to the physical page: [ 17.813785] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104480 [ 17.813833] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 17.813891] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 17.813940] page_type: f5(slab) [ 17.814276] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 17.814426] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.814475] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 17.814522] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.814569] head: 0bfffe0000000001 ffffc1ffc3112001 00000000ffffffff 00000000ffffffff [ 17.814849] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 17.815221] page dumped because: kasan: bad access detected [ 17.815316] [ 17.815345] Memory state around the buggy address: [ 17.815376] fff00000c4480d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.815427] fff00000c4480d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.815519] >fff00000c4480e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.815556] ^ [ 17.815593] fff00000c4480e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.815633] fff00000c4480f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.815669] ==================================================================
[ 11.187544] ================================================================== [ 11.188024] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 11.188337] Read of size 1 at addr ffff888100a9c800 by task kunit_try_catch/184 [ 11.189648] [ 11.189822] CPU: 1 UID: 0 PID: 184 Comm: kunit_try_catch Tainted: G B N 6.15.6-rc1 #1 PREEMPT(voluntary) [ 11.189869] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.189891] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.189912] Call Trace: [ 11.189925] <TASK> [ 11.189942] dump_stack_lvl+0x73/0xb0 [ 11.189970] print_report+0xd1/0x650 [ 11.189993] ? __virt_addr_valid+0x1db/0x2d0 [ 11.190101] ? krealloc_uaf+0x53c/0x5e0 [ 11.190124] ? kasan_complete_mode_report_info+0x64/0x200 [ 11.190148] ? krealloc_uaf+0x53c/0x5e0 [ 11.190166] kasan_report+0x141/0x180 [ 11.190190] ? krealloc_uaf+0x53c/0x5e0 [ 11.190213] __asan_report_load1_noabort+0x18/0x20 [ 11.190234] krealloc_uaf+0x53c/0x5e0 [ 11.190253] ? __pfx_krealloc_uaf+0x10/0x10 [ 11.190270] ? finish_task_switch.isra.0+0x153/0x700 [ 11.190295] ? __switch_to+0x5d9/0xf60 [ 11.190315] ? dequeue_task_fair+0x166/0x4e0 [ 11.190339] ? __schedule+0x10cc/0x2b60 [ 11.190363] ? __pfx_read_tsc+0x10/0x10 [ 11.190382] ? ktime_get_ts64+0x86/0x230 [ 11.190408] kunit_try_run_case+0x1a5/0x480 [ 11.190430] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.190448] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.190473] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.190497] ? __kthread_parkme+0x82/0x180 [ 11.190520] ? preempt_count_sub+0x50/0x80 [ 11.190543] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.190564] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.190587] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.190611] kthread+0x337/0x6f0 [ 11.190628] ? trace_preempt_on+0x20/0xc0 [ 11.190651] ? __pfx_kthread+0x10/0x10 [ 11.190669] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.190691] ? calculate_sigpending+0x7b/0xa0 [ 11.190713] ? __pfx_kthread+0x10/0x10 [ 11.190731] ret_from_fork+0x41/0x80 [ 11.190752] ? __pfx_kthread+0x10/0x10 [ 11.190770] ret_from_fork_asm+0x1a/0x30 [ 11.190799] </TASK> [ 11.190811] [ 11.204328] Allocated by task 184: [ 11.204836] kasan_save_stack+0x45/0x70 [ 11.205425] kasan_save_track+0x18/0x40 [ 11.205736] kasan_save_alloc_info+0x3b/0x50 [ 11.206398] __kasan_kmalloc+0xb7/0xc0 [ 11.206546] __kmalloc_cache_noprof+0x189/0x420 [ 11.206704] krealloc_uaf+0xbb/0x5e0 [ 11.206833] kunit_try_run_case+0x1a5/0x480 [ 11.207232] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.207821] kthread+0x337/0x6f0 [ 11.208151] ret_from_fork+0x41/0x80 [ 11.208539] ret_from_fork_asm+0x1a/0x30 [ 11.208973] [ 11.209156] Freed by task 184: [ 11.209443] kasan_save_stack+0x45/0x70 [ 11.209826] kasan_save_track+0x18/0x40 [ 11.210207] kasan_save_free_info+0x3f/0x60 [ 11.210521] __kasan_slab_free+0x56/0x70 [ 11.210871] kfree+0x222/0x3f0 [ 11.211237] krealloc_uaf+0x13d/0x5e0 [ 11.211671] kunit_try_run_case+0x1a5/0x480 [ 11.211852] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.212250] kthread+0x337/0x6f0 [ 11.212397] ret_from_fork+0x41/0x80 [ 11.212666] ret_from_fork_asm+0x1a/0x30 [ 11.213148] [ 11.213317] The buggy address belongs to the object at ffff888100a9c800 [ 11.213317] which belongs to the cache kmalloc-256 of size 256 [ 11.214372] The buggy address is located 0 bytes inside of [ 11.214372] freed 256-byte region [ffff888100a9c800, ffff888100a9c900) [ 11.214829] [ 11.215067] The buggy address belongs to the physical page: [ 11.215651] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100a9c [ 11.216357] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 11.217106] flags: 0x200000000000040(head|node=0|zone=2) [ 11.217395] page_type: f5(slab) [ 11.217741] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.218511] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.218963] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.219656] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.220073] head: 0200000000000001 ffffea000402a701 00000000ffffffff 00000000ffffffff [ 11.220862] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 11.221494] page dumped because: kasan: bad access detected [ 11.222073] [ 11.222216] Memory state around the buggy address: [ 11.222616] ffff888100a9c700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.223088] ffff888100a9c780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.223645] >ffff888100a9c800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.224075] ^ [ 11.224426] ffff888100a9c880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.225129] ffff888100a9c900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.225389] ================================================================== [ 11.154801] ================================================================== [ 11.155288] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 11.155536] Read of size 1 at addr ffff888100a9c800 by task kunit_try_catch/184 [ 11.156135] [ 11.156262] CPU: 1 UID: 0 PID: 184 Comm: kunit_try_catch Tainted: G B N 6.15.6-rc1 #1 PREEMPT(voluntary) [ 11.156310] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.156322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.156344] Call Trace: [ 11.156357] <TASK> [ 11.156373] dump_stack_lvl+0x73/0xb0 [ 11.156401] print_report+0xd1/0x650 [ 11.156424] ? __virt_addr_valid+0x1db/0x2d0 [ 11.156447] ? krealloc_uaf+0x1b8/0x5e0 [ 11.156465] ? kasan_complete_mode_report_info+0x64/0x200 [ 11.156488] ? krealloc_uaf+0x1b8/0x5e0 [ 11.156565] kasan_report+0x141/0x180 [ 11.156593] ? krealloc_uaf+0x1b8/0x5e0 [ 11.156614] ? krealloc_uaf+0x1b8/0x5e0 [ 11.156661] __kasan_check_byte+0x3d/0x50 [ 11.156699] krealloc_noprof+0x3f/0x340 [ 11.156724] krealloc_uaf+0x1b8/0x5e0 [ 11.156743] ? __pfx_krealloc_uaf+0x10/0x10 [ 11.156760] ? finish_task_switch.isra.0+0x153/0x700 [ 11.156785] ? __switch_to+0x5d9/0xf60 [ 11.156805] ? dequeue_task_fair+0x166/0x4e0 [ 11.156828] ? __schedule+0x10cc/0x2b60 [ 11.156911] ? __pfx_read_tsc+0x10/0x10 [ 11.156932] ? ktime_get_ts64+0x86/0x230 [ 11.156958] kunit_try_run_case+0x1a5/0x480 [ 11.156980] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.156999] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.157024] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.157047] ? __kthread_parkme+0x82/0x180 [ 11.157070] ? preempt_count_sub+0x50/0x80 [ 11.157094] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.157114] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.157138] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.157161] kthread+0x337/0x6f0 [ 11.157179] ? trace_preempt_on+0x20/0xc0 [ 11.157203] ? __pfx_kthread+0x10/0x10 [ 11.157221] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.157243] ? calculate_sigpending+0x7b/0xa0 [ 11.157264] ? __pfx_kthread+0x10/0x10 [ 11.157283] ret_from_fork+0x41/0x80 [ 11.157303] ? __pfx_kthread+0x10/0x10 [ 11.157321] ret_from_fork_asm+0x1a/0x30 [ 11.157352] </TASK> [ 11.157363] [ 11.169321] Allocated by task 184: [ 11.169801] kasan_save_stack+0x45/0x70 [ 11.170080] kasan_save_track+0x18/0x40 [ 11.170341] kasan_save_alloc_info+0x3b/0x50 [ 11.170584] __kasan_kmalloc+0xb7/0xc0 [ 11.171043] __kmalloc_cache_noprof+0x189/0x420 [ 11.171256] krealloc_uaf+0xbb/0x5e0 [ 11.171410] kunit_try_run_case+0x1a5/0x480 [ 11.171591] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.172242] kthread+0x337/0x6f0 [ 11.172391] ret_from_fork+0x41/0x80 [ 11.172649] ret_from_fork_asm+0x1a/0x30 [ 11.173118] [ 11.173203] Freed by task 184: [ 11.173369] kasan_save_stack+0x45/0x70 [ 11.173830] kasan_save_track+0x18/0x40 [ 11.174072] kasan_save_free_info+0x3f/0x60 [ 11.174282] __kasan_slab_free+0x56/0x70 [ 11.174471] kfree+0x222/0x3f0 [ 11.174676] krealloc_uaf+0x13d/0x5e0 [ 11.174973] kunit_try_run_case+0x1a5/0x480 [ 11.175200] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.175437] kthread+0x337/0x6f0 [ 11.175709] ret_from_fork+0x41/0x80 [ 11.175891] ret_from_fork_asm+0x1a/0x30 [ 11.176034] [ 11.176109] The buggy address belongs to the object at ffff888100a9c800 [ 11.176109] which belongs to the cache kmalloc-256 of size 256 [ 11.176841] The buggy address is located 0 bytes inside of [ 11.176841] freed 256-byte region [ffff888100a9c800, ffff888100a9c900) [ 11.177433] [ 11.177936] The buggy address belongs to the physical page: [ 11.178181] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100a9c [ 11.178946] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 11.179247] flags: 0x200000000000040(head|node=0|zone=2) [ 11.179685] page_type: f5(slab) [ 11.179922] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.180350] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.180843] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.181338] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.182084] head: 0200000000000001 ffffea000402a701 00000000ffffffff 00000000ffffffff [ 11.182432] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 11.183072] page dumped because: kasan: bad access detected [ 11.183304] [ 11.183401] Memory state around the buggy address: [ 11.183627] ffff888100a9c700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.184022] ffff888100a9c780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.184327] >ffff888100a9c800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.184807] ^ [ 11.185126] ffff888100a9c880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.185392] ffff888100a9c900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.186091] ==================================================================